Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
22/12/2023, 15:39
General
- Target dcaa73709c1c14e1d1dbc53dcb53a9ab.exe
- Size 250KB
- Sample231222-s3ygpaced2
- SHA256 c918a66b721ead859f84b6bc168265e0d79725529e9f1a9104d2bd5878fdce74
Malware Config
Extracted
-
redline
-
mix09.09
-
185.215.113.15:6043
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcaa73709c1c14e1d1dbc53dcb53a9ab.exe"C:\Users\Admin\AppData\Local\Temp\dcaa73709c1c14e1d1dbc53dcb53a9ab.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4612-1-0x0000000002300000-0x0000000002400000-memory.dmp
memory/4612-2-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/4612-3-0x0000000004110000-0x0000000004136000-memory.dmp
memory/4612-4-0x0000000000400000-0x000000000215C000-memory.dmp
memory/4612-7-0x0000000006900000-0x0000000006910000-memory.dmp
memory/4612-6-0x0000000006900000-0x0000000006910000-memory.dmp
memory/4612-9-0x0000000006840000-0x0000000006864000-memory.dmp
memory/4612-8-0x0000000006910000-0x0000000006EB4000-memory.dmp
memory/4612-5-0x0000000006900000-0x0000000006910000-memory.dmp
memory/4612-10-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/4612-11-0x0000000006EC0000-0x00000000074D8000-memory.dmp
memory/4612-12-0x00000000074E0000-0x00000000074F2000-memory.dmp
memory/4612-13-0x0000000007500000-0x000000000760A000-memory.dmp
memory/4612-14-0x0000000006900000-0x0000000006910000-memory.dmp
memory/4612-15-0x0000000007610000-0x000000000764C000-memory.dmp
memory/4612-16-0x0000000007680000-0x00000000076CC000-memory.dmp
memory/4612-17-0x0000000000400000-0x000000000215C000-memory.dmp
memory/4612-18-0x0000000002300000-0x0000000002400000-memory.dmp
memory/4612-19-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/4612-21-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/4612-22-0x0000000006900000-0x0000000006910000-memory.dmp